Version 4.5.0

system/Login/LoginAbstract.php

@@ -12,7 +12,7 @@
 namespace IPS\Login;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -32,7 +32,7 @@ abstract class _LoginAbstract extends \IPS\Login\Handler
 	 */
 	public static function getTitle()
 	{
-		return 'login_handler_' . mb_substr( get_called_class(), 10 );
+		return 'login_handler_' . mb_substr( \get_called_class(), 10 );
 	}
 	
 	/**
@@ -82,22 +82,29 @@ abstract class _LoginAbstract extends \IPS\Login\Handler
 			}
 			catch ( \Exception $e ) { }
 		}
-		
-		return $this->loginForm( \IPS\Request::i()->url(), FALSE, $destination );
+
+		try
+		{
+			return $this->loginForm( \IPS\Request::i()->url(), FALSE, $destination );
+		}
+		catch ( \Exception $exception )
+		{
+			\IPS\Log::log( $exception, 'login_handler' );
+		}
 	}
 	
 	/**
 	 * Authenticate
 	 *
 	 * @param	\IPS\Login	$login				The login object
-	 * @param	string		$usernameOrEmail	The username or email address provided by the user
-	 * @param	string		$password			The plaintext password provided by the user
+	 * @param	string		$usernameOrEmail		The username or email address provided by the user
+	 * @param	object		$password			The plaintext password provided by the user, wrapped in an object that can be cast to a string so it doesn't show in any logs
 	 * @return	\IPS\Member
 	 * @throws	\IPS\Login\Exception
 	 */
 	public function authenticateUsernamePassword( \IPS\Login $login, $usernameOrEmail, $password )
 	{
-		return $this->authenticate( array( 'auth' => $usernameOrEmail, 'password' => $password ) );
+		return $this->authenticate( array( 'auth' => $usernameOrEmail, 'password' => (string) $password ) );
 	}
 	
 	/**
@@ -115,13 +122,13 @@ abstract class _LoginAbstract extends \IPS\Login\Handler
 	/**
 	 * Create an account from login - checks registration is enabled, the name/email doesn't already exists and calls the spam service
 	 *
-	 * @param	$member|NULL		\IPS\Member	The existing member, if one exists
-	 * @param	$memberProperties	array		Any properties to set on the member (whether registering or not) such as IDs from third-party services
-	 * @param	$name				string|NULL	The desired username. If not provided, not allowed, or another existing user has this name, it will be left blank and the user prompted to provide it.
-	 * @param	$email				string|NULL	The user's email address. If it matches an existing account, an \IPS\Login\Exception object will be thrown so the user can be prompted to link those accounts. If not provided, it will be left blank and the user prompted to provide it.
-	 * @param	$details			mixed		If $email matches an existing account, this is wgat will later be provided to link() - include any data you will need to link the accounts later
-	 * @param	$profileSync		array|NULL	If creating a new account, the default profile sync settings for this provider
-	 * @param	$profileSyncClass	string|NULL	If $profileSync is enabled, the profile sync service with a name matching this login handler will be used. Provide an alternative classname to override (e.g. for Windows login, the login handler class is Live, but the profile sync class is Microsoft)
+	 * @param	\IPS\Member|NULL	$member				The existing member, if one exists
+	 * @param	array				$memberProperties	Any properties to set on the member (whether registering or not) such as IDs from third-party services
+	 * @param	string|NULL			$name				The desired username. If not provided, not allowed, or another existing user has this name, it will be left blank and the user prompted to provide it.
+	 * @param	string|NULL			$email				The user's email address. If it matches an existing account, an \IPS\Login\Exception object will be thrown so the user can be prompted to link those accounts. If not provided, it will be left blank and the user prompted to provide it.
+	 * @param	mixed				$details			If $email matches an existing account, this is wgat will later be provided to link() - include any data you will need to link the accounts later
+	 * @param	array|NULL			$profileSync		If creating a new account, the default profile sync settings for this provider
+	 * @param	string|NULL			$profileSyncClass	If $profileSync is enabled, the profile sync service with a name matching this login handler will be used. Provide an alternative classname to override (e.g. for Windows login, the login handler class is Live, but the profile sync class is Microsoft)
 	 * @return	\IPS\Member
 	 * @throws	\IPS\Login\Exception	If email address matches (\IPS\Login\Exception::MERGE_SOCIAL_ACCOUNT), registration is disabled (IPS\Login\Exception::REGISTRATION_DISABLED) or the spam service denies registration (\IPS\Login\Exception::REGISTRATION_DENIED_BY_SPAM_SERVICE)
 	 */
@@ -173,6 +180,7 @@ abstract class _LoginAbstract extends \IPS\Login\Handler
 	/**
 	 * Can this handler process a password change for a member? 
 	 *
+	 * @param	\IPS\Member	$member		The member
 	 * @return	bool
 	 */
 	public function canChangePassword( \IPS\Member $member )